Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
MIME-Version: 1.0
In-Reply-To: <CALLT8kjfR02Qj2Nttn5n_-NkBzQEChPLE4qr==fiH+3nvJymNA@mail.gmail.com>
References: <CALLT8kjfR02Qj2Nttn5n_-NkBzQEChPLE4qr==fiH+3nvJymNA@mail.gmail.com>
From: "Alex O'Ree" <alexoree@apache.org>
Date: Sun, 16 Jul 2017 10:31:46 -0400
Message-ID: <CALLT8kjJqW8TaG0yN4iJtZBaxnhT9etF0ML-6YrsAYsa6ba3Eg@mail.gmail.com>
Subject: Re: Getting user role membership without context
To: Tomcat Users List <users@tomcat.apache.org>
Content-Type: text/plain; charset="UTF-8"
archived-at: Sun, 16 Jul 2017 14:31:51 -0000

Thanks for the clarification. To add to my description....

I'm running a task on the users behalf on a background thread with a
task scheduler.  I need to get the roles when the task is ran in case
of a change in role membership between the time the task is scheduled
and when it is executed.

It looks like the Digester class loads server.xml and creates the
realms but it looks like it's almost entirely done with dynamic class
loading. I couldn't narrow down the point in code where Realms are
created. Perhaps there's a way to get a reference to the realm via
some static reference? I went through the code but could not find a
solution. I also tried extending the UserDatabaseRealm but was unable
to get it to fire up (new instance) due to the lack of the calling
infrastructure and requisite calls from higher up in the tomcat code
base.

Moving on, I was also poking around in JMX and found that the all
users are listed (and clear text passwords are available? not sure if
this is the case for digested or encrypt file stores).  From this
approach, i was able to parse the output and eventually found
attributes that list all roles a given user account has (success!).
What isn't clear is if this approach will work for LDAP (JNDI)
connections or kerberos setups, SSO setups, etc. It may also be
version specific to tomcat (running 7.0.76 at the moment). I'd
appreciate any feedback on this.

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org